CVE-2024-48426

unknown

Published 2024-10-24 · Modified 2026-05-21

CVSS v3

—

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2

—

VIR risk

—

Description

A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSanitizer. The crash occurred due to a read access to an invalid memory address (0x1000c9714971).

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2024-48426.html

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2024-48426

OS impact

OS	Version	Status
debian	bullseye	affected
debian	forky	affected
debian	sid	affected
debian	trixie	affected
debian	bookworm	affected
sles		affected

Package impact

Ecosystem	Package	Vulnerable	Fixed
PyPI	pyassimp	`<=5.4.3`

References

https://security-tracker.debian.org/tracker/CVE-2024-48426
https://github.com/assimp/assimp/issues/5789
https://www.suse.com/security/cve/CVE-2024-48426.html

Verify integrity in audit chain (admin only). AS-IS.